PT-2023-21563 · Unknown · Go-Used-Util

Cokebeer · Published 2023-03-16 · Updated 2023-08-23 · CVE-2023-28105

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions go-used-util versions prior to 0.0.34

Description The issue is a ZipSlip problem that occurs when using the fsutil package to unzip files. This can lead to path traversal when users use zip.Unzip to unzip zip files from a malicious attacker.

Recommendations For versions prior to 0.0.34, upgrade to version 0.0.34 or above to fix the issue. As a temporary workaround, consider avoiding the use of the zip.Unzip function from the github.com/dablelv/go-huge-util/zip package until the upgrade is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-28105

GHSA-5G39-PPWG-6XX8

GO-2023-1640

Affected Products

Go-Used-Util

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28105.json · Exploit
• https://github.com/dablelv/go-huge-util/commit/0e308b0fac8973e6fa251b0ab095cdc5c1c0956b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28105 · Security Note
• https://osv.dev/vulnerability/GHSA-5g39-ppwg-6xx8 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1640 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28105 · Vendor Advisory
• https://github.com/dablelv/go-huge-util · Note
• https://github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8 · Note
• https://t.me/cvenotify/46347 · Telegram Post
• https://t.me/cibsecurity/60167 · Telegram Post
• https://pkg.go.dev/vuln/GO-2023-1640 · Note